Whirlwind respawn: authentic death->drop-zone->recreate cycle (task #52)

Death transition (mech4) now dispatches VehicleDead(-1) to the owning
player; BTPlayer::VehicleDeadMessageHandler restructured to the authentic
@004c05c4 three-way branch: -1 = death bookkeeping + sever playerVehicle
(wreck stays) + 5s re-post; >=0 = engine drop-zone hunt -> DropZoneReply
-> CreatePlayerVehicle (new mech); -2 = the acquire probe. Guarded on a
DropZones group so a zone-less mission stays dead instead of aborting.

Three latent bugs the respawn path exposed, all fixed:
- IsMechDestroyed latched on graphicAlarm>=9 alone; a later leg hit on the
  wreck rewrites the alarm to 4/3, un-latching -> the death transition
  re-ran (double kill/score, abort). Now latches on movementMode 2||9.
- Score handlers dereferenced the severed playerVehicle during the dead
  window; guarded.
- The console score flush routed a NetworkClient::Message through the
  player's Entity::Dispatch, which stamps entityID past the smaller struct
  -> /RTC1 stack overflow. Sent via application->SendMessage instead.
- Renderer LoadMission re-entry (per viewpoint-make) re-read the env INI;
  its light block Fail'd on stale sceneLightCount. Reset it in
  DPLReadEnvironment so the respawn's second read is clean.

Verified 2-node self-drive: B killed repeatedly by A respawns each time
(wreck stays), ticks + reloads + takes fresh damage on the new mech, no
abort/hang across multiple death->respawn cycles.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

context/reconstruction-gotchas.md

@@ -145,6 +145,17 @@ real PoweredSubsystem). Keep the alloc SIZE + special-cache when swapping a fact
   Hit by: the spawned dummy, replicants, AND — task #47 — a peer's own **MASTER** mech: cross-pod TakeDamage
   reached B, resolved to B's real mech, then `Entity::Receive` saw `valid=0` and deferred it forever → 0
   damage. Fix = `Mech::Make` sets `ValidFlag` for the master too (mech.cpp), not just replicants. [T2]
+- **Never send a NON-Entity message through `Entity::Dispatch`.** `Entity::Dispatch` (ENTITY.cpp:236)
+  unconditionally stamps `message->entityID`/`interestZoneID` at the **Entity::Message** field offsets
+  (after Receiver::Message's 12-byte header). A `NetworkClient::Message` (the console
+  `ConsolePlayer*Message` family) has no such fields and is SMALLER — those stamps write PAST the
+  object. On a stack-allocated console message that is an `/RTC1` stack-guard overflow → `_RTC_StackFailure`
+  → abort (caught on the respawned player's first score flush, task #52). Console/network messages go
+  over the stream: `application->SendMessage(host->GetHostID(), NetworkClient::ConsoleClientID, &msg)`
+  (which forwards to `networkManager->Send` with no entity stamping) — mirror the working VTV-damaged
+  push in `ScoreMessageHandler`, don't call the player's `Dispatch`. (Entity::Dispatch's `messageID <
+  Receiver::NextMessageID` early branch does NOT save you — it lacks a `return`, and the console IDs
+  aren't in that range anyway.) [T2]
 
 ## 10. Container-Execute must override (gauges)
 
@@ -180,6 +191,15 @@ AVs. Fill gaps with a shared read-only pad member. Same for a class's `<Name>Att
   be initialized in EVERY ctor init-list (debug heap fills 0xCDCDCDCD → an uninit flag reads
   TRUE); and any device state a special draw path sets must be save/restored exactly. Deleting
   stale `.obj`s fixes layout-mismatch corruption when a base class grows. [T2]
+- **Status alarm is not a latch:** gauge/status alarms (`graphicAlarm` etc.) are INDICATORS whose
+  level later events legitimately REWRITE (a leg hit on a wreck rewrites 9→4/3). A predicate like
+  `IsMechDestroyed = alarm>=9` un-latches → the wreck "resurrects" and the death transition re-runs
+  (double score, abort in the respawn window). Latch on the state machine's own mode
+  (`movementMode 2||9`); use the alarm only as the entry TRIGGER. (Task #52.) [T2]
+- **Engine `Check`/`Verify` are ACTIVE in MUNGA TUs:** a NULL hitting an engine `Check(ptr)` is an
+  ucrtbased **abort() dialog** ("Debug Error!"), not an AV — `sxe av` won't break there; the box
+  blocks the event loop (a headless node just "stops logging"). cdb: run with a config that does
+  `g` then `kb 40` — the int3 lands ON the aborting thread. [T2]
 
 ---